>From 15251fe7023c4f0c473d713dcb83612be20b8851 Mon Sep 17 00:00:00 2001
From: Christina Fu <cfu@redhat.com>
Date: Thu, 24 Jul 2014 11:31:10 -0700
Subject: [PATCH] authentication fix: fixed issue relating to authentication
 that switching between ESC and tpsclient needs to change CS.cfg param value
 and restart TPS.  This fix makes the issue go away. The actual issue is the
 differences between "loginRequest" and "extendedLoginRequeest".

---
 base/tps-tomcat/shared/conf/CS.cfg.in              |  6 ++--
 .../tps/authentication/AuthenticationManager.java  | 39 +++++++++++++++++-----
 .../tps/authentication/TPSAuthenticator.java       | 22 ++++++++----
 .../server/tps/processor/TPSProcessor.java         | 18 ++++++----
 4 files changed, 62 insertions(+), 23 deletions(-)

diff --git a/base/tps-tomcat/shared/conf/CS.cfg.in b/base/tps-tomcat/shared/conf/CS.cfg.in
index 57a7866a5b3ba0a5bfb5e4d4e69bbb22a854bf09..4ae2b222f1ac528a8831b4aa22e7269fd4578c2f 100644
--- a/base/tps-tomcat/shared/conf/CS.cfg.in
+++ b/base/tps-tomcat/shared/conf/CS.cfg.in
@@ -41,11 +41,13 @@ auths.instance.ldap1.ui.description.en=This authenticates user against the LDAP
 auths.instance.ldap1.ui.id.UID.description.en=LDAP User ID
 auths.instance.ldap1.ui.id.UID.name.en=LDAP User ID
 auths.instance.ldap1.ui.id.UID.credMap.authCred=uid
-auths.instance.ldap1.ui.id.UID.credMap.msgCred=screen_name
+auths.instance.ldap1.ui.id.UID.credMap.msgCred.extlogin=UID
+auths.instance.ldap1.ui.id.UID.credMap.msgCred.login=screen_name
 auths.instance.ldap1.ui.id.PASSWORD.description.en=LDAP Password
 auths.instance.ldap1.ui.id.PASSWORD.name.en=LDAP Password
 auths.instance.ldap1.ui.id.PASSWORD.credMap.authCred=pwd
-auths.instance.ldap1.ui.id.PASSWORD.credMap.msgCred=password
+auths.instance.ldap1.ui.id.PASSWORD.credMap.msgCred.extlogin=PASSWORD
+auths.instance.ldap1.ui.id.PASSWORD.credMap.msgCred.login=password
 auths.instance.ldap1.dnpattern=
 auths.instance.ldap1.ldapByteAttributes=
 auths.instance.ldap1.ldapStringAttributes=mail,cn,uid
diff --git a/base/tps-tomcat/src/org/dogtagpki/server/tps/authentication/AuthenticationManager.java b/base/tps-tomcat/src/org/dogtagpki/server/tps/authentication/AuthenticationManager.java
index 4cfee3e6f16d2408c47ac8c2c5311fa5b6a45fe1..7e9aa6a569d339f57f3cdb132e14a9a04e2c06d6 100644
--- a/base/tps-tomcat/src/org/dogtagpki/server/tps/authentication/AuthenticationManager.java
+++ b/base/tps-tomcat/src/org/dogtagpki/server/tps/authentication/AuthenticationManager.java
@@ -48,11 +48,13 @@ public class AuthenticationManager
      *   auths.instance.ldap1.ui.id.PASSWORD.description.en=LDAP Password
      *   auths.instance.ldap1.ui.id.PASSWORD.name.en=LDAP Password
      *   auths.instance.ldap1.ui.id.PASSWORD.credMap.authCred=pwd
-     *   auths.instance.ldap1.ui.id.PASSWORD.credMap.msgCred=password
+     *   auths.instance.ldap1.ui.id.PASSWORD.credMap.msgCred.extlogin=PASSWORD
+     *   auths.instance.ldap1.ui.id.PASSWORD.credMap.msgCred.login=password
      *   auths.instance.ldap1.ui.id.UID.description.en=LDAP User ID
      *   auths.instance.ldap1.ui.id.UID.name.en=LDAP User ID
      *   auths.instance.ldap1.ui.id.UID.credMap.authCred=uid
-     *   auths.instance.ldap1.ui.id.UID.credMap.msgCred=screen_name
+     *   auths.instance.ldap1.ui.id.UID.credMap.msgCred.extlogin=UID
+     *   auths.instance.ldap1.ui.id.UID.credMap.msgCred.login=screen_name
      *   auths.instance.ldap1.ui.retries=1
      *
      *   # the following are handled by the IAuthManager itself
@@ -225,7 +227,7 @@ public class AuthenticationManager
             IConfigStore credMapSub = uiParamSub.getSubStore(id + ".credMap");
             if (credMapSub == null) {
                 CMS.debug("AuthenticationManager: createAuthentication(): conf "
-                        + uiParamSub.getName() + ".credMapsub" + " null or empty.");
+                        + uiParamSub.getName() + ".credMap" + " null or empty.");
                 continue;
             }
             String authCred = credMapSub.getString("authCred");
@@ -234,17 +236,36 @@ public class AuthenticationManager
                         + credMapSub.getName() + ".authCred" + " null or empty.");
                 continue;
             }
-            String msgCred = credMapSub.getString("msgCred");
-            if (msgCred.isEmpty()) {
+
+            IConfigStore msgCredSub = credMapSub.getSubStore("msgCred");
+            if (msgCredSub == null) {
                 CMS.debug("AuthenticationManager: createAuthentication(): conf "
-                        + credMapSub.getName() + ".msgCred" + " null or empty.");
+                        + uiParamSub.getName() + ".msgCred" + " null or empty.");
                 continue;
             }
+
+            String msgCred_login = msgCredSub.getString("login");
+            if (msgCred_login.isEmpty()) {
+                CMS.debug("AuthenticationManager: createAuthentication(): conf "
+                        + msgCredSub.getName() + ".login" + " null or empty.");
+                continue;
+            }
+
+            String msgCred_extlogin = msgCredSub.getString("extlogin");
+            if (msgCred_extlogin.isEmpty()) {
+                CMS.debug("AuthenticationManager: createAuthentication(): conf "
+                        + msgCredSub.getName() + ".extlogin" + " null or empty.");
+                continue;
+            }
+
             // map the auth mgr required cred to cred name in request message
-            auth.setCredMap(authCred, msgCred);
+            auth.setCredMap_login(authCred, msgCred_login);
+            CMS.debug("AuthenticationManager: createAuthentication(): added cred map_login="
+                    + authCred + ":" + msgCred_login);
+            auth.setCredMap_extlogin(authCred, msgCred_extlogin);
+            CMS.debug("AuthenticationManager: createAuthentication(): added cred map_extlogin="
+                    + authCred + ":" + msgCred_extlogin);
 
-            CMS.debug("AuthenticationManager: createAuthentication(): added cred map="
-                    + authCred + ":" + msgCred);
         }
 
         Integer retries = uiSub.getInteger("retries", 1);
diff --git a/base/tps-tomcat/src/org/dogtagpki/server/tps/authentication/TPSAuthenticator.java b/base/tps-tomcat/src/org/dogtagpki/server/tps/authentication/TPSAuthenticator.java
index 8083343f5904d0ac16b31237f11fb366e6675441..46e6a987052e78655a5dad82cb44fc4d7c4215fe 100644
--- a/base/tps-tomcat/src/org/dogtagpki/server/tps/authentication/TPSAuthenticator.java
+++ b/base/tps-tomcat/src/org/dogtagpki/server/tps/authentication/TPSAuthenticator.java
@@ -54,7 +54,8 @@ public class TPSAuthenticator {
      *   auths.instance.ldap1.ui.id.PASSWORD.credMap.authCred=pwd
      *   auths.instance.ldap1.ui.id.PASSWORD.credMap.msgCred=password
      */
-    private HashMap<String, String> credMap;
+    private HashMap<String, String> credMap_login;
+    private HashMap<String, String> credMap_extlogin;
 
     // retries if the user entered the wrong password/securid
     private int maxLoginRetries = 1;
@@ -73,7 +74,8 @@ public class TPSAuthenticator {
         uiTitle = new HashMap<String, String>();
         uiDescription = new HashMap<String, String>();
         uiParameters = new HashMap<String, AuthUIParameter>();
-        credMap = new HashMap<String, String>();
+        credMap_login = new HashMap<String, String>();
+        credMap_extlogin = new HashMap<String, String>();
     }
 
     public String getID() {
@@ -112,12 +114,20 @@ public class TPSAuthenticator {
         return uiParameters;
     }
 
-    public void setCredMap(String authCred, String msgCred) {
-        credMap.put(authCred, msgCred);
+    public void setCredMap_login(String authCred, String msgCred) {
+        credMap_login.put(authCred, msgCred);
     }
 
-    public String getCredMap(String authCred) {
-        return credMap.get(authCred);
+    public void setCredMap_extlogin(String authCred, String msgCred) {
+        credMap_extlogin.put(authCred, msgCred);
+    }
+
+    public String getCredMap_login(String authCred) {
+        return credMap_login.get(authCred);
+    }
+
+    public String getCredMap_extlogin(String authCred) {
+        return credMap_extlogin.get(authCred);
     }
 
     public int getNumOfRetries() {
diff --git a/base/tps-tomcat/src/org/dogtagpki/server/tps/processor/TPSProcessor.java b/base/tps-tomcat/src/org/dogtagpki/server/tps/processor/TPSProcessor.java
index 735ebc248ac7c27bfbf2c7feb63efb6383fc25de..9f7c5da1ec3fa141c2ce36cb0cb258f4eefc9ea5 100644
--- a/base/tps-tomcat/src/org/dogtagpki/server/tps/processor/TPSProcessor.java
+++ b/base/tps-tomcat/src/org/dogtagpki/server/tps/processor/TPSProcessor.java
@@ -748,17 +748,19 @@ public class TPSProcessor {
      * with mapped values from client
      * configuration example:
      *
-     * auths.instance.ldap1.ui.id.UID.credMap.msgCred=screen_name
+     * auths.instance.ldap1.ui.id.UID.credMap.msgCred.extlogin=UID
+     * auths.instance.ldap1.ui.id.UID.credMap.msgCred.login=screen_name
      * auths.instance.ldap1.ui.id.UID.credMap.authCred=uid
      *
-     * auths.instance.ldap1.ui.id.PASSWORD.credMap.msgCred=password
+     * auths.instance.ldap1.ui.id.PASSWORD.credMap.msgCred.extlogin=PASSWORD
+     * auths.instance.ldap1.ui.id.PASSWORD.credMap.msgCred.login=password
      * auths.instance.ldap1.ui.id.PASSWORD.credMap.authCred=pwd
      *
      * @param response the message response to be mapped
      * @param auth the authentication for mapping consultation
      * @return IAuthCredentials auth credential for auth manager
      */
-    public IAuthCredentials mapCredFromMsgResponse(TPSMessage response, TPSAuthenticator auth)
+    public IAuthCredentials mapCredFromMsgResponse(TPSMessage response, TPSAuthenticator auth, boolean extendedLogin)
             throws EBaseException {
         CMS.debug("TPSProcessor.mapCredFromMsgResponse");
         if (response == null || auth == null) {
@@ -770,7 +772,11 @@ public class TPSProcessor {
 
         String[] requiredCreds = auth.getAuthManager().getRequiredCreds();
         for (String cred : requiredCreds) {
-            String name = auth.getCredMap(cred);
+            String name;
+            if (extendedLogin == true)
+                name = auth.getCredMap_extlogin(cred);
+            else
+                name = auth.getCredMap_login(cred);
             login.set(cred, response.get(name));
         }
 
@@ -813,7 +819,7 @@ public class TPSProcessor {
             throw e;
         }
 
-        IAuthCredentials login = mapCredFromMsgResponse(loginResp, auth);
+        IAuthCredentials login = mapCredFromMsgResponse(loginResp, auth, true /*extendedLogin*/);
 
         return login;
     }
@@ -849,7 +855,7 @@ public class TPSProcessor {
             throw e;
         }
 
-        IAuthCredentials login = mapCredFromMsgResponse(loginResp, auth);
+        IAuthCredentials login = mapCredFromMsgResponse(loginResp, auth, false /*not extendedLogin*/);
         return login;
     }
 
-- 
1.8.4.2

